HumanApproved™ Docs

Test keys and test websites

Test and live are separate environments on the same host, https://uk.humanapproved.com.

	Test	Live
Publishable key	`pk_test_…`	`pk_live_…`
Secret key	`sk_test_…`	`sk_live_…`
Allowed websites	Your test websites: a local development address on any port, or an `https` address	Your live websites, `https` only
Approval code	Not texted: the approval page shows the code to enter	Texted to the customer’s mobile

Each key works only from the allowed websites for its environment. Add each address exactly, with scheme, host and port: there are no wildcards.
Test reviews are separate from live ones. Only a test secret key reads a test review, and a live secret key reads only live ones.
Checks validate quotes against the product’s published version, so publish before you test.

See Keys and environments.

Trigger a test review

To show the pause panel without an AI agent:

Set the product to Every purchase. On the product’s Approval settings page, set When to ask for approval to Every purchase and publish. Every check then asks for approval. Set it back before you go live.
Use an automated browser. A browser driven by a tool such as Playwright is treated as an agent.

With a test key, the approval page shows the code, so you can approve or decline yourself.

Test checklist

With the product on Only when an agent is detected, a normal visit goes straight through, and the check appears under Checks in the portal.
With Every purchase on, the step pauses and the panel shows a link.
The link shows your quote as the customer will see it, with every value right.
Entering the code and approving lets the paused checkout proceed.
Declining tells the agent to ask the customer what they want to do.
The review is under Approvals in the portal, with the quote that was sent.
Your server reads the review with your test secret key and refuses to bind unless it’s approved for that quote.

Go-live checklist

Live key. Replace the test publishable key with your live key, pk_live_…, and your server’s secret key with sk_live_…, from environment variables or your secrets manager.
Live websites. Add your production checkout’s address to the product’s live allowed websites (https only).
Published version. The product has a published version with the right fields, wording and When to ask for approval setting: usually Only when an agent is detected, or Never — monitor only to measure agent traffic first. See Monitor only.
Content Security Policy. Your production policy allows https://cdn.beopen.com in script-src and your region’s address in connect-src (and img-src for a logo). See Content Security Policy.
Pinned script. The embed is loaded on every page of the journey, with the version and integrity hash from the portal’s Embed page.
Server verification. Your server checks the review before it binds: status approved, matching quoteRef, env is live. See Verify on your server.
Bot check. If agents might open the approval link themselves, the product’s bot check is on in its Approval settings: it’s off by default. See Bot check.
Fail-open considered. The embed lets the step proceed when HumanApproved doesn’t respond in time or anything goes wrong. Decide what your server does with a purchase that has no approved review, and in a server or agent flow whether to retry rather than proceed.
Privacy notice. Your privacy notice and cookie policy name the checks, as you would fraud prevention.

Troubleshooting

When something goes wrong, the embed lets the step proceed and writes a warning to the browser console. A refused key or website gets a response without CORS headers, so the browser console shows no response: find the status and code on the request to /api/v1/checks in the browser’s network panel.

You see	Why, and what to do
`403 origin_not_allowed`	The page’s address isn’t an allowed website for the key’s environment. Scheme, host and port must match exactly. Add it to the product’s test or live websites. From a server, send an allowed `Origin` header.
`409 product_not_live`	The key’s product has no published version. Publish it, or check the key belongs to the product you expect.
`401 invalid_key`	The key is mistyped, cut short, revoked, the wrong kind (a secret key where a publishable key goes, or the other way round) or from another region. Use the full key you copied when it was created, or create a new one.
`422 invalid_quote`	A required quote field is missing or the wrong type, or the mobile isn’t a valid mobile number. The error’s `fields` lists each one: compare `quoteDetails` with the product’s published fields.
The browser refuses a request to your region’s address or a script from `cdn.beopen.com`	Your Content Security Policy blocks it. Add the source: see Content Security Policy.
Failed to find a valid digest in the `integrity` attribute	The version and hash in the script tag don’t match. Copy them together from the Embed page.
Nothing happens on click: the step never pauses	Make sure `before` matches the right element and `protect` runs from a file, not an inline script. Also make sure the product isn’t set to Never — monitor only, and checks appear under Checks. To see the pause panel, set the product to Every purchase.